Questions tagged [wannacry]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
95 views

Wannacry testing in lab - Not getting SMB scan attempts

So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is ...
1
vote
0answers
61 views

How to affect VMs in a network using WannaCry?(Cuckoo Sandbox)

I have a network consisting of 2 VMs(Windows 7). VM1:- 192.168.56.101 VM2:- 192.168.56.102 Both are connected to vboxnet0 (192.168.56.1). I infected VM1 using WannaCry ransomware but the ...
1
vote
0answers
193 views

What is the role of LLMNR, NBSS and NBNS protocols in WannaCry?

I know that LLMNR is the "new version" of NetBIOS and both of them are basically for resolving names to IP addresses I also know some exploits based on them, like a MiTM attack that the attacker ...
0
votes
1answer
80 views

Is it safe to install MS17-010 unpatched OS as guest on patched host?

For example, these are unpatched old OS. Windows 98 Windows 98 SE Windows ME Windows NT 4.0 Windows 2000 Given that SMBv1 is not disabled on host but already patched. Is the unpatched guest OS ...
4
votes
1answer
386 views

Why was the NX bit unable to stop WannaCry?

I'm working on a presentation to give to high school computer science students where I work at as a volunteer. Part of the presentation is on local and network exploits. I am planning to talk about ...
-1
votes
1answer
87 views

Wrong user or IP in High Sierra terminal

When reinstalling MacOS High Sierra, setting root user password I have noticed strange line dsl-201-101-1-179-sta: before my admin username user$. I Googled and found references to WannaCry ...
6
votes
3answers
912 views

Spectre and Meltdown being used in large scale attack on unpatched systems [closed]

Do we have to be worried about Spectre and Meltdown being used for a large scale attack like Wannacry? Even though the patches coming out are being deployed to a most recent systems, there will ...
5
votes
2answers
642 views

Are we safe from infection of Bad Rabbit?

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
3
votes
1answer
5k views

WannaCry Source Code

Maybe this is a stupid question: Is the WannaCry source code public? https ://github.com/svenvdz/wannacry https: //github.com/Hackstar7/WanaCry https: //github.com/fadyosman/WannaCrySample I didn'...
3
votes
0answers
261 views

What does Memory Scanning refer to in the Context of Malware Detection Wanna Cry

When reading https://www.zionsecurity.com/sites/default/files/what_to_expect_from_your_antivirus.pdf It mentions: It is almost impossible to protect against new malware that will use the ...
1
vote
2answers
1k views

How did Wanna Cry get past Antivirus Programs

For those who had windows computers when the WannaCry virus hit, how exactly did the virus bypass antivirus programs. I have tried to read some papers about this, but I don't understand how exactly ...
0
votes
2answers
198 views

WannaCry attack

The kill switch discovered by marcus hutchins the web security researcher, how did that kill switch actually work? ,domain name registration must have been done on the system of researcher , how did ...
2
votes
2answers
806 views

Can the new WannaCry affect Linux ext4 file system data from Windows?

So every now and then I switch over to my Windows 10 OS from my Linux partition. Whilst I am there, I am fully aware that I can be infected with WannaCry which will encrypt all the files on the system....
1
vote
1answer
135 views

Can a WannaCry infection via zero day vector be blocked by an antivirus?

We know that an AV would be able to stop a WannaCry executable that can be found in an attack email/file just before double-clicking. However would an anti-virus be able to block against a WannaCry ...
1
vote
1answer
170 views

How is Malware Traced to a Specific Country? [duplicate]

Following the WannaCry malware being traced to North Korea, how is the malware traced to a specific country? How I think this could be done: Malware is reverse engineered to find IP addresses or ...
4
votes
1answer
882 views

How can Malware authors be determined? [duplicate]

My question is: How can we make any conclusions about malware authors at all, when anyone could just get sample malware online, copy paste the parts they like, and add their own parts to it? ...
2
votes
2answers
335 views

How to protect from wannacry on home wifi network

I am running an outdated Windows 7 and am not able to update it due to some reasons. I wanted to know how vulnerable is my Windows to WannaCry from the home wifi network connection. What would you ...
-1
votes
1answer
603 views

WannaCry DNS abilities

I was checking sandbox and information on the killswitch link but the WannaCry does not do a DNS query. How does it call out? www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
8
votes
2answers
750 views

Does Wannacry spread outside its private subnet to adjacent private subnets?

Does a Wannacry-infected computer on an internal network with a private IP address attempt to spread to other privately-addressed subnets? I have not found a definitive answer online. Cisco says: ...
1
vote
2answers
434 views

Is it possible to recover wannacry encrypted files through file system recovery?

As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS. Is it possible to use a bootable ...
2
votes
2answers
3k views

Does Wanna Cry encrypt files on network drives?

I've dealt with ransomware threats in the past, such as LOCKY that not only encrypt data it considers user documents found on the local machine, but also on any network drive to which the user has ...
65
votes
3answers
16k views

What happens if you run WannaCry after installing the necessary patches?

I understand that WannaCry spreads itself by exploiting the SMBv1 vulnerability, which is fixed by patch MS17-010. Does this mean that even with the patch installed, WannaCry can still infect the ...
2
votes
1answer
939 views

Effective blocking of SMB connections on AsusWRT

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
1
vote
2answers
204 views

Would it be possible and advisable to create a worm to patch for WannaCrypt?

WannaCrypt uses an SMB vulnerability to spread. Can we not use this vulnerability to create a similar worm, but one which patches for WannaCrypt instead of affecting it. Our worm infects a computer ...
2
votes
2answers
3k views

EternalBlue exploit doesn't work against windows 8

i have tried this poc: https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e against a windows 8 target that i own, the code exits with an error that says: impacket.nmb.NetBIOSTimeout: ...
0
votes
2answers
725 views

Is a insecure VM in a secure host vulnerable to wannacry?

Assume a reasonably secure windows host (latest windows updates/patches, up-to date enterprise antivirus). How vulnerable is in this context a VM with a not up to date windows OS and an old and not ...
6
votes
1answer
2k views

What happens if a Dropbox folder is encrypted by WannaCrypt / WannaCry?

Does one's Dropbox "data in the cloud" also get encrypted?
2
votes
1answer
305 views

How does WannaCrypt detect when someone pays the ransom?

It seems they are processing it manually, but how can they verify the payment? WannaCry doesn't provide a unique ransom bitcoin adress for each victim.
15
votes
4answers
5k views

Has anybody successfully decrypted their files after paying the WannaCrypt ransom?

WannaCrypt is a shot heard 'round the world, for sure. I have seen news articles saying that people have paid more than $20,000 in ransoms. Here's one from Krebs: Global ‘Wana’ Ransomware Outbreak ...
2
votes
1answer
679 views

Is WannaCry Proxy Aware?

I read the Article of WannaCry on malwaretech.com and as far I understand it works like this: Try to connect via HTTP to www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com if it got an response then ...
2
votes
1answer
2k views

WannaCry - block callback IP/domain?

While new variants of Wannacry has sprung up, the old variant is still lurking around corners and I am not sure whether the following callback IPs and domains should be blocked as per typical ...
1
vote
1answer
650 views

How can we beef the security of our Windows Server 2012 R2 against ransomware? [duplicate]

We have a MS Windows Server 2012 installed. After the attacks of last week, I was wondering how we could improve the security of the server against ransomware/cryptoware. We did install the latest ...
5
votes
2answers
533 views

Does EMET prevent WannaCry exploit execution?

Based on answers to the question How is the “WannaCry” Malware spreading (...), I understand it leverages vulnerabilities present in the SMB implementation. Assuming an unpatched and otherwise ...
5
votes
1answer
2k views

How to reverse engineer WannaCry? [closed]

I was reading an article today about a Google researcher linking the WannaCry malware to the earlier malware Cantopee. I had two primary questions based on the contents of the article. What do the ...
15
votes
1answer
19k views

How does the EternalBlue Exploit Work?

I've casually googled for explanations on how exactly the EternalBlue exploit works but, I suppose given the media storm about WannaCry, I've only been able to find resources that at best say it's an ...
1
vote
5answers
9k views

Will Running MEMZ or Wanna Cry in VirtualBox Harm Host Computer?

I have read some threads talking about the safety of running malware in a VM. I found out that it may not be safe and there is still a risk. I would like to know specifically if running Wanna Cry, a ...
1
vote
1answer
395 views

Does the WannaCry Ransomware affect VMs which are connected in Network? [closed]

I have a lot of Windows VMs, viz XP, Server 2003, Vista and 7. All of them are in Network and connected to Internet. Will they be affected by WannaCry if not patched ?
1
vote
3answers
953 views

What do emails have to do with the spread of WannaCrypt?

After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them. But the malware is spreading as a worm using SMB to infect other ...
26
votes
3answers
34k views

Does WannaCry infect Linux? [duplicate]

After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu. One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is ...
248
votes
10answers
82k views

How is the “WannaCry” Malware spreading and how should users defend themselves from it?

There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names. It ...